Human Security, the cybersecurity firm that processes over one quadrillion web interactions through its Human Defense Platform, released its 2026 State of AI Traffic & Cyberthreat Benchmark Report on Wednesday and the numbers confirm what anyone running a business online has probably suspected for months: the internet is no longer a place built primarily for people.
Automated traffic grew 23.51% year over year, roughly eight times the 3.10% growth rate of human traffic over the same period. AI agent traffic, the kind generated by autonomous systems that can browse, click, scrape, and transact without a person behind them, grew 7,851% in 2025. That is not a typo. Nearly eight thousand percent.
And the concentration is staggering. OpenAI’s bots, which include ChatGPT User, OAI-SearchBot, GPTBot, and ChatGPT Agent, account for approximately 69% of all observed AI traffic by volume. Meta-ExternalAgent adds another 16%. Anthropic’s ClaudeBot and Claude-SearchBot contribute roughly 11%. Three companies generate 96% of the AI traffic hitting your website, your ad campaigns, and your analytics dashboards.
The business problem nobody wants to quantify
If you run Google Ads, you are bidding against bots. If you track website conversions, your funnel includes bot visits. If your SEO strategy relies on organic traffic, a growing share of that traffic is a language model scraping your content to answer someone else’s question in a chatbot window, never sending the human your way.
The entire digital advertising and content marketing ecosystem was built on the assumption that traffic equals attention and attention equals a person with a wallet. That assumption is breaking, and the speed of the break is what should concern anyone running campaigns. This is not a slow drip. AI traffic surged 187% from January to December 2025 alone, which means the gap between what your analytics report and what is actually happening on your site is widening every month.
Google and Meta are both the measurement platforms and two of the three largest sources of AI bot traffic. Google runs the ad auction and crawls your site with its own AI agents simultaneously. Meta runs the ad targeting and sends Meta-ExternalAgent to index your pages. The companies selling you traffic analytics are the same companies generating the non-human traffic that contaminates those analytics. Nobody is explaining how those numbers get separated, because separating them would mean admitting the contamination exists.
The counter argument
Not all bot traffic is bad. AI crawlers that index content for search and retrieval are, in theory, doing the same thing Google’s original spider did in 1998. The Human Security report itself distinguishes between benign automated traffic and malicious bot activity. The 7,851% growth in agentic AI traffic includes legitimate tools like shopping agents and research assistants that may actually convert into revenue. And Human Security has an obvious commercial interest in making bot traffic sound terrifying, because their product exists to detect and block it.
If 23% of internet traffic growth is automated, and that number is accelerating, then the infrastructure businesses built their customer acquisition on is rotting from the inside. Every SEO strategy, every paid media campaign, every conversion rate optimization framework, every attribution model that assumes traffic equals humans, all of it needs to be stress tested against a simple question: what percentage of the activity I am measuring and paying for is actually a person. The companies best positioned to answer that question are the same ones generating the bot traffic, and they have no incentive to give you an honest number.
What This Means for Everyday People
If you have ever wondered why the internet feels different now, why search results seem less useful, why ads follow you with eerie precision but the products are wrong, why engagement metrics keep climbing while actual sales stay flat, this is part of the answer. The web is increasingly a conversation between machines, with humans as an afterthought in their own digital spaces. The botnet takedowns make headlines, but the legal bot traffic reshaping the entire internet economy barely gets mentioned.
The companies responsible for building AI systems that generate this traffic are the same ones asking for regulatory protection, arguing they need special treatment because their technology is too important to constrain. They are simultaneously the architects of the problem and the ones selling the solution.